# Generated by iptables-save v1.8.3 on Tue Jun  2 19:34:31 2026
*raw
:PREROUTING ACCEPT [9835885:10043522801]
:OUTPUT ACCEPT [467359:99218227]
:CONNLIMIT - [0:0]
[fastid: 0] -A PREROUTING -j CONNLIMIT
COMMIT
# Completed on Tue Jun  2 19:34:31 2026
# Generated by iptables-save v1.8.3 on Tue Jun  2 19:34:31 2026
*nat
:PREROUTING ACCEPT [524:197593]
:INPUT ACCEPT [247:76309]
:OUTPUT ACCEPT [268:20686]
:POSTROUTING ACCEPT [57:6776]
:AUTONAT - [0:0]
:DNSIKUAI8 - [0:0]
:DNSIKUAI8_NOAUTH - [0:0]
:DNSPROXY - [0:0]
:DSTNAT - [0:0]
:HTTPPROXY - [0:0]
:HTTPSPROXY - [0:0]
:MINIUPNPD - [0:0]
:MINIUPNPD-POSTROUTING - [0:0]
:NATRULE_DNAT - [0:0]
:NATRULE_SNAT - [0:0]
:NETNAT - [0:0]
:NOTICE - [0:0]
:POST_FULLCONE - [0:0]
:PRE_FULLCONE - [0:0]
:VRRPNAT - [0:0]
[fastid: 0] -A PREROUTING -p udp -m udp --dport 53 -m conntrack --ctstate NEW -m comment --comment DNSPROXY -j REDIRECT --to-ports 5300
[fastid: 0] -A PREROUTING -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW -m ifaces --ifaces lan,vlan,ppp,tap0,sovpn,sdwan,ikec,doc_ --dir in -j HTTPPROXY
[fastid: 0] -A PREROUTING -p udp -m udp --dport 53 -m conntrack --ctstate NEW -m ifaces --ifaces lan,vlan,ppp,tap0,sovpn,sdwan,ikec,doc_ --dir in -j DNSIKUAI8
[fastid: 0] -A PREROUTING -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW -m ifaces --ifaces lan,vlan,ppp,tap0,sovpn,sdwan,ikec,doc_ --dir in -j NOTICE
[fastid: 0] -A PREROUTING -m conntrack --ctstate NEW -m addrtype --dst-type LOCAL -j DSTNAT
[fastid: 0] -A PREROUTING -m conntrack --ctstate NEW -j NATRULE_DNAT
[fastid: 0] -A PREROUTING -m conntrack --ctstate NEW -m addrtype --dst-type LOCAL -j MINIUPNPD
[fastid: 0] -A PREROUTING -j PRE_FULLCONE
[fastid: 0] -A PREROUTING -p udp -m udp --dport 53 -m conntrack --ctstate NEW -m ifaces --ifaces lan,vlan,ppp,tap0,sovpn,sdwan,ikec,doc_ --dir in -j DNSPROXY
[fastid: 0] -A POSTROUTING -j POST_FULLCONE
[fastid: 0] -A POSTROUTING -j AUTONAT
[fastid: 0] -A AUTONAT ! -d 127.0.0.1/32 -m ifaces --ifaces wan,vwan,adsl,pptp,l2tp,ovpn,iked --dir out -m policy --dir out --pol none -j MASQUERADE
[fastid: 0] -A AUTONAT ! -d 127.0.0.1/32 -m addrtype ! --dst-type LOCAL -m local_host --dir src --fwd-self -m ifaces --ifaces ppp,lan,vlan --dir out -j MASQUERADE
[fastid: 0] -A AUTONAT ! -d 127.0.0.1/32 -m addrtype ! --dst-type LOCAL -m local_host --dir src -m ifaces --ifaces ppp,sovpn --dir out ! --pppoe -j MASQUERADE
[fastid: 0] -A DNSIKUAI8 -p udp -m udp --dport 53 -m string --hex-string "|06706f7274616c0b696b756169382d7769666903636f6d00|" --algo bm --to 65535 -j REDIRECT --to-ports 54
[fastid: 0] -A DNSIKUAI8 -p udp -m udp --dport 53 -m string --hex-string "|056c6f63616c06696b7561693803636f6d00|" --algo bm --to 65535 -j REDIRECT --to-ports 54
[fastid: 0] -A DNSIKUAI8 -p udp -m udp --dport 53 -m string --hex-string "|06706f7274616c06696b7561693803636f6d00|" --algo bm --to 65535 -j REDIRECT --to-ports 54
[fastid: 0] -A DNSIKUAI8 -p udp -m udp --dport 53 -m string --hex-string "|03696f6306696b7561693803636f6d00|" --algo bm --to 65535 -j REDIRECT --to-ports 54
[fastid: 0] -A DNSIKUAI8 -p udp -m udp --dport 53 -m string --hex-string "|02696b046175746805677261706802717103636f6d00|" --algo bm --to 65535 -j REDIRECT --to-ports 54
[fastid: 0] -A DNSIKUAI8 -p udp -m udp --dport 53 -m string --hex-string "|02696b04617574680361706905776569626f03636f6d00|" --algo bm --to 65535 -j REDIRECT --to-ports 54
[fastid: 0] -A DNSIKUAI8 -p udp -m udp --dport 53 -m set ! --match-set Linux_webauth_authed_list src -j DNSIKUAI8_NOAUTH
[fastid: 0] -A DNSIKUAI8_NOAUTH -p udp -m udp --dport 53 -m set --match-set Linux_webauth_default src -m string --hex-string "|11636f6e6e6563746976697479636865636b08706c6174666f726d076869636c6f756403636f6d00|" --algo bm --to 65535 -j REDIRECT --to-ports 54
[fastid: 0] -A DNSIKUAI8_NOAUTH -p udp -m udp --dport 53 -m set --match-set Linux_webauth_default src -m string --hex-string "|11636f6e6e6563746976697479636865636b07616e64726f696403636f6d00|" --algo bm --to 65535 -j REDIRECT --to-ports 54
[fastid: 0] -A DNSIKUAI8_NOAUTH -p udp -m udp --dport 53 -m set --match-set Linux_webauth_default src -m string --hex-string "|08636c69656e74733306676f6f676c6503636f6d00|" --algo bm --to 65535 -j REDIRECT --to-ports 54
[fastid: 0] -A DNSIKUAI8_NOAUTH -p udp -m udp --dport 53 -m set --match-set Linux_webauth_default src -m string --hex-string "|037777770e7468696e6b646966666572656e7402757300|" --algo bm --to 65535 -j REDIRECT --to-ports 54
[fastid: 0] -A DNSIKUAI8_NOAUTH -p udp -m udp --dport 53 -m set --match-set Linux_webauth_default src -m string --hex-string "|0377777707616972706f727402757300|" --algo bm --to 65535 -j REDIRECT --to-ports 54
[fastid: 0] -A DNSIKUAI8_NOAUTH -p udp -m udp --dport 53 -m set --match-set Linux_webauth_default src -m string --hex-string "|037777770569626f6f6b04696e666f00|" --algo bm --to 65535 -j REDIRECT --to-ports 54
[fastid: 0] -A DNSIKUAI8_NOAUTH -p udp -m udp --dport 53 -m set --match-set Linux_webauth_default src -m string --hex-string "|037777770669746f6f6c7304696e666f00|" --algo bm --to 65535 -j REDIRECT --to-ports 54
[fastid: 0] -A DNSIKUAI8_NOAUTH -p udp -m udp --dport 53 -m set --match-set Linux_webauth_default src -m string --hex-string "|0763617074697665056170706c6503636f6d00|" --algo bm --to 65535 -j REDIRECT --to-ports 54
[fastid: 0] -A DNSIKUAI8_NOAUTH -p udp -m udp --dport 53 -m set --match-set Linux_webauth_default src -m string --hex-string "|037777770f6170706c656970686f6e6563656c6c03636f6d00|" --algo bm --to 65535 -j REDIRECT --to-ports 54
[fastid: 0] -A DNSIKUAI8_NOAUTH -p udp -m udp --dport 53 -m set --match-set Linux_webauth_default src -m string --hex-string "|07636f6e6e65637403726f6d046d69756903636f6d00|" --algo bm --to 65535 -j REDIRECT --to-ports 54
[fastid: 0] -A DNSIKUAI8_NOAUTH -p udp -m udp --dport 53 -m set --match-set Linux_webauth_default src -m string --hex-string "|03706d73026d6202717103636f6d00|" --algo bm --to 65535 -j REDIRECT --to-ports 54
[fastid: 0] -A DNSIKUAI8_NOAUTH -p udp -m udp --dport 53 -m set --match-set Linux_webauth_default src -m string --hex-string "|05636f6e6e310a6f70706f6d6f62696c6503636f6d00|" --algo bm --to 65535 -j REDIRECT --to-ports 54
[fastid: 0] -A DSTNAT -p tcp+udp -m multiport --dports 10080 -m ifname--ifname  wan1_ad -j DNAT --to-destination 192.168.18.253
[fastid: 0] -A DSTNAT -p tcp+udp -m multiport --dports 43224 -m ifname--ifname  wan1_ad -j DNAT --to-destination 192.168.18.253:3389
[fastid: 0] -A DSTNAT -p tcp+udp -m multiport --dports 8088 -m ifname--ifname  wan1_ad -j DNAT --to-destination 192.168.18.253
[fastid: 0] -A DSTNAT -p tcp+udp -m multiport --dports 10081 -m ifname--ifname  wan1_ad -j DNAT --to-destination 192.168.18.253
[fastid: 0] -A DSTNAT -p tcp+udp -m multiport --dports 43223 -m ifname--ifname  wan1_ad -j DNAT --to-destination 192.168.18.253:3306
[fastid: 0] -A HTTPPROXY -d 1.0.0.0/32 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 689
[fastid: 0] -A HTTPPROXY -d 1.0.0.0/32 -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 700
[fastid: 0] -A NOTICE -p tcp -m tcp --dport 80 -m addrtype ! --dst-type LOCAL -m local_host ! --dir dst -m set --match-set Linux_WEBTO_default src -m set ! --match-set Linux_WEBTO_whiteip dst -m urlroute  ! --urlroute pppauth -j REDIRECT --to-ports 685
[fastid: 0] -A NOTICE -p tcp -m tcp --dport 443 -m addrtype ! --dst-type LOCAL -m local_host ! --dir dst -m set --match-set Linux_WEBTO_default src -m set ! --match-set Linux_WEBTO_whiteip dst -m urlroute  ! --urlroute pppauth -j REDIRECT --to-ports 686
COMMIT
# Completed on Tue Jun  2 19:34:31 2026
# Generated by iptables-save v1.8.3 on Tue Jun  2 19:34:31 2026
*mangle
:PREROUTING ACCEPT [9825651:10042528790]
:INPUT ACCEPT [473768:122599541]
:FORWARD ACCEPT [9294092:9906904876]
:OUTPUT ACCEPT [466695:98995952]
:POSTROUTING ACCEPT [9744281:10005147662]
:DPROTO - [0:0]
:FASTOFFLOAD - [0:0]
:IPSEC_ROUTE - [0:0]
:LAYER7_IN - [0:0]
:LAYER7_OUT - [0:0]
:PPTPMSS - [0:0]
:STREAM_IPPORT_NEW - [0:0]
:STREAM_LAYER7_NEW - [0:0]
[fastid: 0] -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1401:65535 -j TCPMSS --set-mss 1400
[fastid: 0] -A FORWARD -j FASTOFFLOAD
[fastid: 0] -A POSTROUTING -o vwan+ -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1401:65535 -j TCPMSS --set-mss 1400
COMMIT
# Completed on Tue Jun  2 19:34:31 2026
# Generated by iptables-save v1.8.3 on Tue Jun  2 19:34:31 2026
*filter
:INPUT ACCEPT [224474:63974775]
:FORWARD ACCEPT [4243270:4435063660]
:OUTPUT ACCEPT [252086:51666566]
:ACL_MAC - [0:0]
:ARP - [0:0]
:AUTH_EXPIRES - [0:0]
:CONNLIMIT - [0:0]
:DHCP_ACL - [0:0]
:FIREWALL - [0:0]
:FLOW_CONTROL - [0:0]
:IKE_QOS - [0:0]
:INPUT_ACL - [0:0]
:IP_QOS - [0:0]
:L2TP_QOS - [0:0]
:LAN_VISIT - [0:0]
:MAC_QOS - [0:0]
:MINIUPNPD - [0:0]
:NONAT - [0:0]
:OVPN_QOS - [0:0]
:PPP - [0:0]
:PPPOE - [0:0]
:PPPOE_QOS - [0:0]
:PPTP_QOS - [0:0]
:QOS - [0:0]
:VNCACL - [0:0]
:WEBACL - [0:0]
:WEBAUTH - [0:0]
:WEBAUTH_QOS - [0:0]
[fastid: 0] -A INPUT -p udp -m udp --dport 5300 -m comment --comment DNSPROXY -j ACCEPT
[fastid: 0] -A INPUT -p udp -m set --match-set DROP_U_PORTS_WAN_IN dst -m ifaces --ifaces wan,vwan,adsl --dir in -j DROP
[fastid: 0] -A INPUT -p tcp -m set --match-set DROP_T_PORTS_WAN_IN dst -m ifaces --ifaces wan,vwan,adsl --dir in -j DROP
[fastid: 0] -A INPUT -j INPUT_ACL
[fastid: 0] -A INPUT -j WEBACL
[fastid: 0] -A INPUT -j VNCACL
[fastid: 0] -A INPUT -p udp -m udp --dport 67 -j DHCP_ACL
[fastid: 0] -A FORWARD -m ifaces --ifaces ppp --dir in -j AUTH_EXPIRES
[fastid: 0] -A FORWARD -j ACL_MAC
[fastid: 0] -A FORWARD -j CONNLIMIT
[fastid: 0] -A FORWARD -j QOS
[fastid: 0] -A FORWARD -j PPTP_QOS
[fastid: 0] -A FORWARD -j WEBAUTH_QOS
[fastid: 0] -A FORWARD -j FIREWALL
[fastid: 0] -A FORWARD -j NONAT
[fastid: 0] -A FORWARD -m ifaces --ifaces lan,vlan,tap0 --dir in -j WEBAUTH
[fastid: 0] -A AUTH_EXPIRES -p tcp -m set --match-set Linux_WEBTO_default src -m set ! --match-set Linux_WEBTO_whiteip dst -m urlroute  ! --urlroute pppauth -j REJECT --reject-with icmp-port-unreachable
[fastid: 0] -A AUTH_EXPIRES -p udp -m udp ! --dport 53 -m set --match-set Linux_WEBTO_default src -m set ! --match-set Linux_WEBTO_whiteip dst -m urlroute  ! --urlroute pppauth -j REJECT --reject-with icmp-port-unreachable
[fastid: 0] -A DHCP_ACL -p udp -m udp --dport 67 -m ifaces --ifaces lan,vlan --dir in -m set --match-set Linux_dhcp_aclmac_default src -j DROP
[fastid: 0] -A WEBACL -p tcp -m ifaces --ifaces wan,vwan,adsl --dir in -m set --match-set Linux_webport_default dst -j DROP
[fastid: 0] -A WEBAUTH -m set --match-set Linux_webauth_default src -j ACCEPT
COMMIT
# Completed on Tue Jun  2 19:34:31 2026
